Consider using --sandbox feature

[alexlarsson]

I added --sandbox to flatpak-builder, which disallows the json manifest to do things like --share=network and do network i/o, or --filesystem=/foo to be able to access the host. This is targeted at buildsystems like f-b-s, so we should probably start using it.